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Abstract —This letter considers a network comprising a trans¬ 
mitter, which employs random linear network coding to encode 
a message, a legitimate receiver, which can recover the mes¬ 
sage if it gathers a sufficient number of linearly independent 
coded packets, and an eavesdropper. Closed-form expressions for 
the probability of the eavesdropper intercepting enough coded 
packets to recover the message are derived. Transmission with 
and without feedback is studied. Furthermore, an optimization 
model that minimizes the intercept probability under delay and 
reliability constraints is presented. Results validate the proposed 
analysis and quantify the secrecy gain offered by a feedback link 
from the legitimate receiver. 

Index Terms —Network coding, fountain coding, physical layer 
security, secrecy outage probability, intercept probability. 


I. Introduction 

In the context of networks and protocols, network coding m 
has been widely recognized as an intriguing technique to im¬ 
prove network performance. It can considerably reduce trans¬ 
mission delay, processing complexity and energy consumption, 
and has the potential to significantly increase throughput and 
robustness El. Therefore, it has been studied for use in many 
applications, including large scale content distribution in peer- 
to-peer networks 0 and data transmission in sensor networks 
or delay tolerant networks 0. Due to the broadcast nature 
of wireless channels, networks are vulnerable to security 
attacks, such as wiretapping and eavesdropping. The problem 
of achieving secure communication in systems employing 
network coding has recently attracted the attention of the 
research community in wireles networks. Ning and Yeung 0 
first formulated the concept of secure network coding, which 
avoids information leakage to a wiretapper. They imposed a 
security requirement, that is, the mutual information between 
the source symbols and the symbols received by the wiretapper 
must be zero for secure communication. Based on a well- 
designed precoding matrix, Wang et al. |6| proposed a secure 
broadcasting scheme with network coding to obtain perfect 
secrecy. Probabilistic weak security for linear network coding 
was presented in (7J, which devised network coding rules that 
can improve security depending on the adopted field size, the 
number of transmitted symbols and the ability of the attacker 
to eavesdrop on one or more independent channels. 
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Figure 1. Block diagram of the system model, where eq and ee denote the 
erasure probabilities of the channels linking Alice to Bob and Alice to Eve, 
respectively. 

Recently, the intercept probability of fountain coding, which 
is equivalent to random linear network coding for wireless 
broadcast applications, was formulated in 0. Our work has 
been inspired by the methodology in j8j but differs in two 
major points. Firstly, we have revisited the derivation of the in¬ 
tercept probability. More specifically, the decoding probability 
of a receiver has been taken into account in our calculations. 
Furthermore, key probability expressions have been revised 
to accurately reflect (i) the effect of the size of the finite 
field over which network coding is performed, (ii) the impact 
of a feedback link between the legitimate receiver and the 
transmitter, and (iii) the fact that the number of transmitted 
coded packets cannot be infinite in practice. The second 
difference is that 0 proposed an optimization model with 
respect to the number of source packets composing a message. 
However, the number of source packets and, by extension, 
their length are often dictated by the provided service. Our 
objective is to minimize the intercept probability by optimizing 
the number of transmitted coded packets, under delay and 
reliability constraints. As part of the optimization process, we 
prove that awareness of the existence of an eavesdropper is 
not required by the transmitter and the legitimate receiver. 

II. System Model 

We consider a network configuration whereby a source 
(Alice) wishes to transmit a message to a legitimate destination 
(Bob) in the presence of a passive eavesdropper (Eve), as 
shown in Fig. 1. Before initiating the communication process, 
Alice segments the message into K source packets and em¬ 
ploys Random Linear Network Coding (RLNC) to generate 
and broadcast N > K coded packets. The links connecting 
Alice to Bob and Alice to Eve are modeled as packet erasure 
channels characterized by erasure probabilities £b and £e> 
respectively. As per the RLNC requirements. Bob and Eve 
can recover the message only if they collect at least K linearly 
independent coded packets. 

Based on this setup and the general condition that £b < £e 
for physical layer security, we consider two network coded 
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transmission modes, which we refer to as Feedback-aided 
Transmission (FT) and Unaided Transmission (UT). In the FT 
mode, Alice broadcasts up to N coded packets but ceases 
transmission as soon as Bob sends a notification over a 
perfect feedback channel acknowledging receipt of K linearly 
independent coded packets. In the case of UT, a feedback 
channel between Bob and Alice is not available, therefore 
Alice broadcasts exactly N coded packets anticipating Bob 
to successfully recover her message. In both modes, the 
communication process is considered to be secure if Eve fails 
to reconstruct Alice’s message. In the rest of this letter, we will 
investigate the resilience of FT and UT to the interception of 
K linearly independent coded packets by Eve. 


III. Performance Analysis 


The physical layer security offered by the two transmission 
modes will be quantified by the probability that Eve will 
manage to recover the message. To derive this probability, 
which is known as the secrecy outage probability or the 
intercept probability , we will first consider the general case 
of point-to-point communication between Alice and a receiver 
D over an erasure channel with erasure probability £/)■ Note 
that D can be either Bob or Eve, i.e., D £ {B,E}. If Alice 
transmits N > K coded packets and the receiver retrieves 
n R coded packets, where K < n R < N, the probability that 
the receiver will successfully recover the K source packets is 
given by 


A-1 


P(n R ,I<)= n [ 


1 ~q 




i =0 


(i) 


where q is the size of the finite field over which network coding 
operations are performed. Let X be a random variable that 
represents the number of transmitted coded packets for which 
the receiver can recover the K source packets. The Cumulative 
Distribution Function (CDF) of X describes the probability 
that the receiver will recover the K source packets after nj 
coded packets have been transmitted, where K < nj < N. 
This CDF can be obtained by averaging O over all valid 
values of tt,r, that is, 

I'd () = Pr {X < nr} 

= E ( HT ) (! - £ D ) nR ^- nR P(n R , K). (2) 

The probability that the receiver will recover the K source 
packets when the m-th coded packet has been transmitted, but 
not earlier, is given by the Probability Mass Function (PMF) 
of X, which can be derived as follows: 


fa (a t ) = Pr {X = n T } 

( F D (n T ) - F D (n T - 1), if K < n T < N (3) 
~\ F d (K), if m = K. 


Let us now return our focus to the considered network 
configuration operating in the FT mode. Recall that Bob sends 
an acknowledgement to Alice when he receives K linearly 
independent coded packets and can thus recover the source 


message. The intercept probability can be expressed as the 
sum of two constituent probabilities: 

P^(N) = P BE (N) + P E (N). (4) 

The first term of the sum in (0), Pbe(N), denotes the probabil¬ 
ity that both Bob and Eve will recover the message. This can 
happen if Bob decodes the message only after the nx-th coded 
packet has been transmitted, while Eve has already recovered 
the message or recovers it concurrently with Bob. Invoking the 
definitions in (0 and (|3}, and considering all possible values 
of nr, we can express Pbe(-N) as 

N 

Pbe(N) = ^ /b(ht) F E (nr)- (5) 

nj—K 

The second term of the sum in P E (N), represents the 
probability that Eve will be successful in recovering the mes¬ 
sage but Bob will fail to decode it after Alice has transmitted 
the complete sequence of N coded packets. Using the CDF 
of the number of coded packets delivered by Alice to Eve and 
Bob, respectively, we can write P E (N) as follows: 

P e (N) = F e {N)[1-F b {N)}. ( 6 ) 

We should stress that © and © are exact only if the sequence 
of coded packets delivered over the Alice-to-Bob link is 
independent of the sequence delivered over the Alice-to-Eve 
link. This is a common hypothesis in the literature of broadcast 
networks, e.g., ED and ED, and is valid for a non-vanishing 
product between the number of coded packets transmitted over 
a channel and the erasure probability of that channel flTI. The 
accuracy of (|4]i will also be demonstrated in Section [V] 

In the case of UT, a feedback channel is not available 
between Bob and Alice, therefore Alice transmits the complete 
sequence of N coded packets uninterruptedly. Therefore, the 
intercept probability is simply equal to the probability that Eve 
will recover the message after Alice has transmitted N coded 
packets. Using the definition of the CDF in d2j, we obtain 

P™(N)=F E (N). (7) 

Manipulation of the expression for PXf(N), as shown in 
Appendix lAl and subtraction of /’A 1 (A - ) from it, yields 

N 

P£(N) - P^(N) =-J2 /e("t) MrtT ~ 1). (8) 

nj=K-\-l 

Expression <[8]> measures the loss in the intercept capability 
of Eve or, equivalently, the gain in secrecy by Bob, if Bob 
can acknowledge the recovery of the source message to Alice 
using a feedback channel. 

Remark. In this letter, we assume that Alice has knowledge of 
the average channel conditions, characterized by the erasure 
probability, between her and Bob. If Alice could sense the 
instantaneous channel quality and transmitted coded packets 
only when the channel quality warranted their error-free deliv¬ 
ery to Bob, as in j8], II12| , the equivalent erasure probability of 
the link between Alice and Bob would be £b = 0. In that case, 
Alice could generate exactly I\ linearly independent coded 
packets in a deterministic manner, as opposed to random, and 
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Figure 2. Comparison between analytical and simulation results for FT and 
UT, when e E e [0.1, 0.5], e B = {0.01,0.03,0.05,0.07,0.09}. K = 50, 
N = 150, q = 2 and P = 90. 

forward them to Bob. As a result, the intercept probability 
would reduce to (1 — £ E ) A regardless the transmission mode. 
This remark concurs with the conclusion of (8J that an arbitrar¬ 
ily small intercept probability can be achieved by increasing 
the value of K, but at the cost of increased delay. 

IV. Optimization Model 

This section aims to determine the optimum value of N, i.e., 
the number of coded packet transmissions, that minimizes the 
intercept probability, provided that a hard deadline is met. This 
hard deadline, denoted by N, represents the number of coded 
packet transmissions that Alice is not allowed to exceed. In 
addition, the proposed optimization strategy permits Bob to 
recover the message with a target probability P. In the rest of 
this letter, both FT and UT will be optimized by the Resource 
Allocation Model (RAM), which is defined as follows: 

(RAM) min P int (N) (9) 

N 

subject to Fb{N) > P (10) 

N<N (11) 

where the objective function © represents the intercept 
probability when N coded packets have been scheduled for 
transmission. Constraint (ITOl) ensures that the probability of 
Bob recovering the message is at least P, while constraint (fill 
imposes that the number of planned coded packet transmis¬ 
sions is less than or equal to N. 

The proof of the following proposition will contribute to the 
solution of the RAM problem. 

Proposition 1. The intercept probability Pi„ t (N ) is a non¬ 
decreasing function of N, i.e., 

Pint{Ni) < Pi„,(N 2 ) for all N\ < N 2 . (12) 

Proof: One of the properties of CDFs is that they are non¬ 
decreasing functions and, as per ©, the intercept probability 
of UT is equal to a CDF In the case of FT, the subtraction 



Figure 3. Contour map (solid lines) depicting the loss in intercept probability 
caused by the change from UT to FT, as a function of £e and £q. The value 
of N* (dashed line) as a function of £b has been superimposed on the plot. 

of -Pint(-Vi) from Tjnt(V 2 ) for N 2 > Ni gives a sum of 
non-negative terms, as shown in Appendix [B] Therefore, 
rjnt( V 2 ) — -Pint(-Wi) >0, which concludes the proof. ■ 

We can now proceed to Proposition U and provide a de¬ 
scription of the solution to the RAM problem. 

Proposition 2. If the RAM problem admits a solution, the 
optimum solution is 

N* = argmin j N £ [ K , N] \ F B (N) > P j . (13) 

Proof: Let N* denote the smallest value of N in the 
interval [K, N] for which constraint (ITOl) holds. If an integer 
value smaller than N* is selected, for example N* — 1, the 
intercept probability will reduce, as per Proposition |T] but 
constraint © will not be met. We thus conclude that N* 
is the optimum solution to the RAM problem. ■ 

Root-finding algorithms, such as the bisection method, can 
be used on the right-hand side of (fl~3]> to determine if N* 
exists and identify its value. Based on this analysis, we showed 
that minimization of the intercept probability under delay 
and reliability constraints can be achieved by minimizing the 
number of transmitted coded packets. Thus, Alice should know 
the erasure probability of the channel between her and Bob but 
knowledge of the presence of an eavesdropper is not necessary. 

V. Numerical and Analytical Results 
This section compares the derived analytical expressions 
with simulation results, establishes their validity and obtains 
solutions to the RAM problem for various channel conditions. 

Fig. [2] depicts the relationship between the intercept proba¬ 
bility and the quality of Bob’s and Eve’s channels, represented 
by £b and £e, respectively. For each point, the value of 
the N coded packet transmissions was optimized by RAM 
for K = 50 source packets, N = 150 maximum allowable 
coded packet transmissions, a field size of q = 2 and a 
target probability of Bob recovering the source message equal 
to P = 90%. In simulations, Alice broadcasts the optimal 
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number of coded packets determined by RAM. Instances 
where Eve successfully recovers K linearly independent coded 
packets are counted and averaged over 10 4 realizations to ob¬ 
tain the intercept probability. We observe the close agreement 
between analytical and simulation results, which confirms the 
tightness of 0 and 0. Fig. [2] also shows that when the 
channel quality between Alice and Eve is significantly worse 
than the channel quality between Alice and Bob, the intercept 
probability is close to zero for both FT and UT. As expected, 
the intercept probability increases when the two channels 
experience identical or relatively similar conditions but FT 
offers a clear advantage over UT. For example, for t B = 0.09 
and se = 0.1, the intercept probability will reduce from 68% 
to 45% if the mode of operation switches from UT to FT. The 
reduction in the intercept probability due to the adoption of 
FT becomes pronounced when e e drops below 0.25. 

Fig. |3] quantifies the loss in intercept probability or, equiv¬ 
alently, the gain in secrecy that occurs by changing the 
operational mode from UT to FT, as noted in 0. The optimum 
value of N, denoted by N*, has also been plotted in Fig. [3 
(secondary y-axis on the right-hand side of the plot). Observe 
that as £b increases from 0.01 to 0.1, Alice increases the coded 
packet transmissions from 54 to 59 in an effort to maintain the 
probability of Bob recovering the source message at P = 90%. 
Notice the abrupt change in the intercept probability each time 
RAM generates a new optimum value for N, based on £b- 

A way to reduce the intercept probability, especially in 
settings where the values of £b and e E are similar, has been 
hinted in the Remark. If Alice can measure the instantaneous 
quality of the channel between her and Bob and transmits 
coded packets only when the measured quality is above an 
acceptable threshold, the effective value of £b will be reduced 
and the intercept probability will drop at the expense of delay. 

VI. Conclusion 

We derived accurate expressions for the intercept probability 
of a network, where a transmitter uses random linear network 
coding to broadcast information. Both unaided transmission 
and feedback-aided transmission were investigated and the 
secrecy gain achieved by the latter approach was computed. 
We presented a resource allocation model to minimize the 
intercept probability, while satisfying delay and reliability 
constraints, and showed that the legitimate receiver is not 
required to have knowledge of the presence of an eavesdrop¬ 
per. Theoretical and simulation results identified the channel 
erasure probabilities for which feedback-aided transmission 
offers a lower intercept probability than unaided transmission 
when the proposed resource allocation model is applied. 

Appendix 

A. Reformulation of the intercept probability of FT 

Based on the definition of the PMF in CD. the expression 
for P BE (N ) in 0 can be expanded as follows: 

P be (N) = F B (K)F E (K) 

- F B (K)F E (K + 1) + F b (K + 1 )F e (K + 1) 

- F b (N - 1)F E (JV) + F b {N)F e (N). 


If we create pairs from each two consecutive terms, with the 
exception of the last term, and invoke again the definition of 
the PMF, we obtain 

r n i 


Pbe(N) 


5? /e(?it) F B (m 


1) + F B (N)F E (N). 


_ m=K-\-i 


In 0, we established that P E (N) = F E (N) — F B (N)F E (N). 
Using 0, the intercept probability of FT can be expressed as: 

N 

P£(N) = F e (N)~ J2 Hn T )F B (m-l). (14) 

nT=if+1 


B. Proof of Proposition \T\for the case of FT 

In order to prove Proposition Q] for the FT mode, it suffices 
to set A = -Pint(Ay) — Pmt(A r i) and show that A > 0 for all 
N 2 > N\. Using «m, we find that 

n 2 

A = F e {N 2 ) - F e (A!) - ^ f E (n r ) F B {n T - 1). (15) 

nx=iVi + l 

Terms —F E [i) and F E (i) for i = N\ + 1,..., N 2 — 1, which 
cancel each other out, are added to F E (N 2 ) — F e (Ni) and give 


F e {N 2 ) - Fe(Ni) = ( F e (N 2 ) - F E {N 2 
... + (F e (Ni + 1) 
n 2 

= Y fti™?)- 

7lT=iVl + l 

If we substitute (fl6]> into (1 1 5t i. we obtain 


!)) + •■■ 

F e ( NJ) 

(16) 


n 2 

a = yy /e(«t) [1 — -Pb(^t — 1)] 

Tl'Y = N\ -\-1 

which is a sum of non-negative terms and is, thus, A > 0. 
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